feat(vnext): validate relation catalog data

[Light2Dark]

Summary

• add an authenticated, package-private catalog-provider boundary
• decode hostile request, response, invalidation, and epoch data into bounded frozen values
• validate canonical and completion paths through authenticated dialect runtimes
• define provider closure ownership, alias copying, page atomicity, and epoch semantics in ADR 0005
• add boundary contracts and worst-case performance benchmarks

Why

Catalog metadata crosses an asynchronous host boundary and cannot be trusted as typed data at runtime. This slice gives the upcoming coordinator a small, deterministic input surface without coupling catalog providers to sessions, CodeMirror, DOM state, or provider-supplied SQL.

Validation

• 1,727 unit tests passed plus one governed expected failure
• changed coverage: 95.61% statements, 95.10% branches, 100% functions, 95.55% lines
• strict and loose optional type configurations, lint, integrity, package smoke, browser, and worker-placement checks passed
• three independent adversarial reviews approved exact SHA b9f6d3e
• million-unit hostile text rejects in about 0.003 ms; near-limit Dremio response decodes in about 0.27 ms

Part of #169.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	95.55% (🎯 91%)	344 / 360
🔵	Statements	95.61% (🎯 91%)	349 / 365
🔵	Functions	100% (🎯 90%)	31 / 31
🔵	Branches	95.12% (🎯 85%)	312 / 328

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/vnext/relation-catalog-boundary.ts	95.61%	95.12%	100%	95.55%	285-286, 294-295, 371, 409, 434, 445, 468, 502, 559, 597, 701, 707, 741, 783
src/vnext/relation-completion-types.ts	0%	0%	0%	0%

Generated in workflow #737 for commit b9f6d3e by the Vitest Coverage Report Action

[Copilot]

Pull request overview

Adds a vnext “relation catalog boundary” that captures a caller-owned provider as a this-free closure, decodes untrusted provider data into bounded frozen values, and validates dialect-legal canonical/completion paths before they can affect completion rendering.

Changes:

• Enforce this: void provider callback contracts at the type level and add a d.ts regression test for receiver-dependent callbacks.
• Introduce relation-catalog-boundary decoding/validation utilities (provider capture, request/response decoding, invalidation decoding, epoch comparison) with strict resource limits.
• Add extensive unit tests and a Vitest benchmark plus a new bench:catalog-boundary script; document semantics in ADR 0005.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/vnext-types/marimo-relation-completion.test-d.ts	Adds type-level coverage ensuring provider callbacks are this-free closures.
src/vnext/relation-completion-types.ts	Updates provider callback types to require this: void for search and subscribe.
src/vnext/relation-catalog-boundary.ts	New boundary module: captures providers and decodes/validates catalog requests/responses with budgets and dialect checks.
src/vnext/tests/relation-catalog-boundary.test.ts	Comprehensive unit tests for capture/decoding behavior, hostile shapes, and resource limits.
src/vnext/tests/relation-catalog-boundary.bench.ts	Benchmark suite for common and worst-case boundary decode scenarios.
package.json	Adds bench:catalog-boundary script.
docs/adr/0005-parser-independent-relation-completion.md	Documents provider ownership, atomic page semantics, epoch handling, and updated limits.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.